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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF MARYLAND 



ATB&JtttQfS 



BALTIMORE DIVISION 



IN THE MATTER OF THE APPLICATION 
OF THE UNITED STATES OF AMERICA 
FOR A SEARCH WARRANT FOR THE 
LAVABIT LLC, EMAIL ACCOUNT 
JOEY006@LAVABIT.COM 



Crim. No. 



13-0607SAG 



AFFIDAVIT IN SUPPORT OF SEARCH WARRANT 



Your Affiant, Daniel E. O'Donnell, Special Agent with the Federal Bureau of 
Investigation, Linthicum, MD, Violent Crimes Against Children Section, Major Case 
Coordination Unit, being duly sworn, hereby deposes and states as follows: 

1 . Your Affiant has been employed as a Special Agent (SA) with the Federal Bureau 
of Investigation (FBI) since March 2004, and is currently assigned to the FBI's Violent Crimes 
Against Children Section (VCAC), Major Case Coordination Unit (MCCU). Your Affiant is 
currently investigating federal violations concerning child pornography and the sexual 
exploitation of children and has gained experience through training in seminars, classes, and 
everyday work related to these types of investigations. Your Affiant has participated in the 
execution of numerous warrants involving the search and seizure of computers, computer 
equipment, software, and electronically stored information. 

2. As a federal agent, Your Affiant is authorized to investigate violations of the laws 
of the United States and is a law enforcement officer with the authority to execute warrants 
issued under the authority of the United States. 

3. This affidavit is made in support of applications for a search warrant for 
information associated with a certain account that is stored at a premises owned, maintained, 
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controlled, or operated by Lavabit LLC, an electronic mail/Internet service provider 
headquartered at 3930 McKinney Avenue, #576, Dallas, Texas 75204. Lavabit LLC is a web- 
based e-mail provider incorporated in Texas in 2004 that provides free and paid e-mail services 
to approximately 60,000 users. The information to be searched is described in the following 
paragraphs and in Attachment B. This affidavit is made in support of an application for a search 
warrant under Title 18, United States Code (U.S.C.) §§ 2251 and 2252A, involving the use of a 
computer in or affecting interstate commerce to transport, advertise, receive, distribute, possess 
and/or access child pornography; to require Lavabit LLC. to disclose to the government records 
and other information in its possession pertaining to the subscriber or customer associated with 
the electronic mail account (e-mail), joey006@lavabit.com, more particularly described in 
Attachment A. 

4. Your Affiant is requesting authority to search the e-mail account where the items 
specified in Attachment A may be found, and to seize all items listed in Attachment B as 
instrumentalities, fruits, and evidence of crime. 

5. Since this affidavit is being submitted for the limited purpose of securing a search 
warrant, I have not included each and every fact known to me concerning this investigation. I 
have set forth only the facts I believe necessary to establish probable cause to believe that 
evidence, fruits, and instrumentalities of the violations of Title 18, U.S.C. §§ 2251 and 2252A, 
involving the use of a computer in or affecting interstate commerce to advertise, transport, 
receive, distribute, possess and/or access child pornography, are presently located within the e- 
mail accountjoey006@lavabit.com. Where statements of others are set forth in this Affidavit, 
they are set forth in substance and in part. 
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6. This investigation, described more fully below, has revealed that the individual 
using the e-mail accountjoey006@lavabit.com did knowingly utilize e-mail to transport, 
advertise, receive, distribute, possess and/or access child pornography and that there is probable 
cause to believe there is evidence, fruits, and instrumentalities of the violations of Title 18, 
U.S.C. §§ 2251 and 2252A located in the e-mail account. 

STATUTORY AUTHORITY 

7. This investigation concerns alleged violations of Title 18, U.S.C, §§ 2251 and 
2252A, relating to material involving the sexual exploitation of minors: 

a. 18 U.S.C. § 225 1 (d)(1)(a) prohibits a person from knowingly making, printing, 
publishing, or causing to be made, printed, or published, any notice or advertisement seeking or 
offering to receive, exchange, buy, produce, display, distribute, or reproduce, any visual 
depiction, if the production of such visual depiction involves the use of a minor engaging in 
sexually explicit conduct and such visual depiction is of such conduct. 

b. 1 8 U.S.C. § 2252 A prohibits a person from knowingly mailing, transporting, 
shipping, receiving, distributing, reproducing for distribution, possessing any child pornography, 
as defined in 18 U.S.C. §2256(8), when such child pornography was either mailed or shipped or 
transported in interstate or foreign commerce by any means, including by computer, or when 
such child pornography was produced using materials that had traveled in interstate or foreign 
commerce. 

BACKGROUND ON COMPUTERS AND CHILD PORNOGRAPHY 

8. Based on my knowledge, training, and experience in child exploitation and child 
pornography investigations, and the experience and training of other law enforcement officers 
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with whom I have had discussions, computers, computer technology, and the Internet have 
revolutionized the manner in which child pornography is produced and distributed. . 

9. Individuals who have a sexual interest in children or images of children may 
receive sexual gratification, stimulation, and satisfaction from contact with children, or from 
fantasies they may have viewing children engaged in sexual activity or in sexually suggestive 
poses, such as in person, in photographs, or other visual media, or from literature describing such 
activity. 

10. Individuals who have a sexual interest in children or images of children often 
maintain their collections that are in a digital or electronic format in a safe, secure and private 
environment, such as a computer and surrounding area. These collections are often maintained 
for several years and are kept close by, usually at the collector's residence, to enable the 
individual to view the collection, which is valued highly. 

1 1 . Individuals who have a sexual interest in children or images of children also 
may correspond with and/or meet others to share information and materials, rarely destroy 
correspondence from other child pornography distributors/collectors, conceal such 
correspondence as they do their sexually explicit material, and often maintain lists of names, 
addresses, telephone numbers, and/or e-mail accounts of individuals with whom they have been 
in contact and who share the same interests in child pornography. 

12. Individuals who have a sexual interest in children or images of children prefer 
not to be without their child pornography for any prolonged time period. This behavior has been 
consistently documented by law enforcement officers involved in the investigation of child 
pornography. 
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13. In addition, computer files or remnants of such files can be recovered months or 
even years after they have been downloaded onto a hard drive, deleted, or viewed via the 
Internet. Electronic files downloaded to a hard drive can be stored for years at little to no cost. 
Even when such files have been deleted, they may be recoverable months or years later using 
readily available forensic tools. 

14. Collectors and distributors of child pornography also use online resources to 
retrieve and store child pornography, including services offered by Internet Portals such as 
Yahoo! and Gmail, among others. The online services allow a user to set up an account with a 
remote computing service that provides e-mail services as well as electronic storage of computer 
files in any variety of formats. A user can set up an online storage account from any computer 
with access to the Internet. Evidence of such online storage of child pornography is often found 
on the user's computer. Even in cases where online storage is used, however, evidence of child 
pornography can be found on the user's computer in most cases. 

1 5. Further, based on my knowledge, training, and experience in child exploitation 
and child pornography investigations, and the experience and training of other law enforcement 
officers with whom I have had discussions, collectors and distributors of child pornography often 
utilize the same online account(s), such as an e-mail account, for an extended period of time to 
collect and distribute child pornography material. One of the reasons for this is to establish the 
account(s) as being known to other collectors and distributors of child pornography to foster the 
individual's ability to obtain child pornography material. Similar investigations involving the 
distribution of child pornography materials via e-mail have routinely identified individuals who 
have utilized the same e-mail account(s) for an extended period of time; many times over a 
multiple-year period. 
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16. As courts have repeatedly held, collectors, and those involved with the 
distribution of child pornography more generally, hold onto their collections of child 
pornography for extended periods of time. See e.g., United States v. Richardson, 2008 WL 
818863 (W.D.N.C. 2008), affd, - F.3d -, 2010 WL 2340233 (4th Cir. 2010)(holding that 
information that was two months to seventeen months old was not stale because the warrant 
included information that the defendant transmitted child pornography using his AOL e-mail in 
June 2004 and September 2005 and had a criminal history of sex offenses involving children). 

PROBABLE CAUSE 

17. On 02/20/2013, the Honolulu Division of the Federal Bureau of Investigation 
(FBI) executed a federal search warrant at a residence utilized by an individual hereafter referred 
to as "K.K", in regards to the distribution of child pornography (CP) via his e-mail account, 
hereafter referred to as "A". 

18. Pursuant to this search warrant on 02/20/2013, K.K. voluntarily provided the FBI 
consent to assume his online identities and signed a Consent to Assume Online Identity 
Authorization Form. This consent was witnessed by Special Agent Ethan Cumming, FBI. As 
part of this consent, K.K. provided user IDs and passwords for multiple online accounts he 
utilized. One of these accounts was "A". 

19. On 02/22/2013 and 02/27/2013, Special Agent Cumming provided the 
aforementioned user IDs and consent form to your Affiant for further investigation. 

20. On 03/05/20 1 3, pursuant to the above consent, your Affiant accessed the e-mail 
account "A" from an Internet connection at the FBI's VCAC, MCCU's offices in Linthicum, 
Maryland, and reviewed the contents. 
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2 1 . Analysis of the "A" account revealed over 1 ,200 e-mails sent between this 
account and numerous other e-mail accounts. The majority of these e-mails appeared to contain 
CP images and videos, child erotica images and videos, or text indicative of an interest in CP and 
child erotica. One of these other e-mail accounts was identified as joey006@lavabit.com. 

22. On 03/08/20 13. your Affiant again accessed the e-mail account "A" from an 
Internet connection at the FBI's VCAC, MCCU's offices in Linthicum, Maryland, and 
downloaded the entire contents of the account to a computer maintained at the MCCU's offices 
in Linthicum, Maryland. 

23. One of the e-mail accounts identified as having sent or received CP images, child 
erotica images, or text indicative of an interest in CP to/from "A" was identified as 

j oey006@lavabit. com. 

JOEYQ06(g)LAVABIT.COM INVESTIGATION 

24. Analysis of the e-mail account "A" revealed e-mail conversation and multiple CP 
or child erotica images being sent between "A" andjoey006@lavabit.com from January 8, 2013 
through January 18, 2013. Examples of these are as follows: 

25. On January 8, 2013, at approximately 08:26: 1 3 (-0500), the user of the e-mail 

accountjoey006@lavabit.com sent an e-mail to "A" that contained one attached image, 

described as follows: 

a. "RE_hi.jpg": An image depicting a partially naked prepubescent female 
wearing pink and white underwear. The underwear is being pulled open by what appears to an 
adult's fingers, exposing the prepubescent female's vagina. Her face is not visible in the image. 

26. On January 9, 2013, at approximately 05:33:45 (-0500), the user of the e-mail 
accountjoey006@lavabit.com sent an e-mail to "A" that contained one attached image, 
described as follows: 
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a. "RE_hi2.jpg": An image depicting a prepubescent female wearing a light 
green or yellow shirt and naked from the waist down. The prepubescent female is lying on her 
back with legs spread apart, exposing her vagina. 

27. On January 18, 2013, at approximately 07:50:49 (-0500), the user of the e-mail 

accountjoey006@lavabit.com sent an e-mail to "A" that contained one attached image, 

described as follows: 

a. "c06.jpg": An image depicting what appears to be a prepubescent female 
wearing a light blue shirt. The prepubescent female is facing what appears to be an adult 
wearing a white shirt and blue jeans, with the zipper open. The prepubescent female's right hand 
is holding the left side of the zipper open, while her left hand is on the zipper itself. No faces are 
visible in the image. 

CONCLUSION 

28. Your Affiant has probable cause to believe that Lavabit LLC, 3930 McKinney 
Avenue, #576. Dallas, Texas 75204, maintains evidence of a violation of Title 18, U.S.C. §§ 
225 1 and 2252A, involving the use of a computer in or affecting interstate commerce to 
advertise, transport, receive, distribute, possess and/or access child pornography. This evidence, 
listed in Attachment B to this affidavit, which is incorporated herein by reference, is contraband, 
the fruits of crime, or things otherwise criminally possessed, or property which is or has been 
used as the means of committing the foregoing offenses. 

29. Therefore, I respectfully request that the attached warrant be issued authorizing 
the search and seizure of the items listed in Attachment B, 

30. Pursuant to Title 1 8, U.S.C. § 2703(g), the presence of a law enforcement officer 
is not required for the service or execution of this warrant. 

3 1 . Pursuant to Title, 18 U.S.C. § 2705(b), I would request the Court order Lavabit 
LLC, not to notify any other person of the existence of this warrant for the next 1 80 days. This 
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request is made because I believe notification of the existence of the warrant will seriously 
jeopardize the ongoing investigation. 




Special Agent 

Daniel E. O'Donnell 

Federal Bureau of Investigation 



SUBSCRIBED TO AND SWORN BEFORE ME 
THIS ^"^ D AY OF MARCH 2013 
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ATTACHMENT A 
ITEMS TO BE SEIZED AND SEARCHED 

This warrant applies to information associated with the e-mail account, 
joey006@lavabit.com, which is stored at premises owned, maintained, controlled, or operated by 
Lavabit LLC, a company headquartered at 3930 McKinney Avenue, #576, Dallas, Texas 75204. 
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ATTACHMENT B 
SPECIFIC ITEMS TO BE SEIZED 

I. Information to be disclosed by Lavabit LLC. 

Lavabit LLC, is required to disclose the following information to the government for 

each account or identifier listed in Attachment A, for the time from September 1, 2012, through 
March 28, 2013: 

1 . The contents of all e-mails stored in the account, including copies of 
e-mails sent to and from the account, draft e-mails, the source and destination e-mails sent 
addresses associated with each e-mail, the date and time at which each e-mail was sent, and the 
size and length of each e-mail; 

2. All records or other information regarding the identification of the 
account, to include full name, physical address, telephone numbers and other identifiers, records 
of session times and durations, the date on which the account was created, the length of service, 
the types of service utilized, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative e-mail addresses provided 
during registration, methods of connecting, log files, and means and source of payment 
(including any credit or bank account number); 

3. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 

4. All records pertaining to communications between 
joey006@lavabit.com and any person regarding this account, including contacts with support 
services and records of actions taken. 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence and 
instrumentalities of violations of Title 18, U.S.C. §§ 2251 and 2252A, involving e-mail 
joey006@lavabit.com; including, for each account or identifier listed on Attachment A, 
information pertaining to the following matters: 

1 . Communications to/from the e-mail account joey006@lavabit.com 
that demonstrate the ongoing violations of Title 18, U.S.C. §§ 2251 and 2252A. 

2. ' Records relating to who created, used, or communicated with the 
account or identifier, including records about their identities and whereabouts. 



